On 2/3/26 23:53, [email protected] wrote:
>> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
>> --- a/kernel/bpf/core.c
>> +++ b/kernel/bpf/core.c
>
> [ ... ]
>
>> @@ -2422,11 +2423,17 @@ static bool bpf_map_owner_matches(const struct
>> bpf_map *map, const struct bpf_prog *fp,
>> case BPF_MAP_OWNER_MATCH_FOR_INIT:
>> if (owner->kprobe_write_ctx != aux->kprobe_write_ctx)
>> return false;
>> + if (owner->call_get_func_ip != fp->call_get_func_ip)
>> + return false;
>> break;
>>
>> case BPF_MAP_OWNER_MATCH_FOR_UPDATE:
>> if (!owner->kprobe_write_ctx && aux->kprobe_write_ctx)
>> return false;
>> + if (bpf_prog_has_trampoline(fp)) {
>> + if (!owner->call_get_func_ip && fp->call_get_func_ip)
>> + return false;
>> + }
>> break;
>
> The FOR_UPDATE path correctly guards the call_get_func_ip check with
> bpf_prog_has_trampoline(fp), since only trampoline-based programs
> rely on the func IP stored on the trampoline stack. Kprobe programs
> get func_ip from kprobe_running()->addr via bpf_get_func_ip_kprobe(),
> which is independent of the trampoline.
>
> Should the FOR_INIT path have the same bpf_prog_has_trampoline()
> guard? Without it, two kprobe programs that share a prog_array will
> be rejected if one calls bpf_get_func_ip() and the other does not,
> even though mixing is safe for kprobes.
>
> bpf_check_tail_call() calls this with BPF_MAP_OWNER_MATCH_FOR_INIT:
>
> kprobe prog_a (call_get_func_ip=1) loads, references jmp_table
> -> owner->call_get_func_ip = 1
> kprobe prog_b (call_get_func_ip=0) loads, references same jmp_table
> -> owner->call_get_func_ip != fp->call_get_func_ip
> -> returns false, prog_b fails to load
>
> Something like this would match the FOR_UPDATE scoping:
>
> case BPF_MAP_OWNER_MATCH_FOR_INIT:
> if (owner->kprobe_write_ctx != aux->kprobe_write_ctx)
> return false;
> if (bpf_prog_has_trampoline(fp)) {
> if (owner->call_get_func_ip != fp->call_get_func_ip)
> return false;
> }
> break;
>
Correct.
The FOR_INIT path should have the same bpf_prog_has_trampoline() guard.
I'll do it in the next revision.
Thanks,
Leon
>
> ---
> AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
> See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
>
> CI run summary: https://github.com/kernel-patches/bpf/actions/runs/22582690876
>
> AI-authorship-score: medium
> AI-authorship-explanation: The v1 selftests carried Assisted-by Codex tags,
> and the kernel code follows a mechanical copy-paste pattern across commits;
> the v2 selftests were rewritten but the overall series structure suggests
> AI-assisted development.
> issues-found: 1
> issue-severity-score: low
> issue-severity-explanation: The FOR_INIT strict equality check on
> call_get_func_ip is missing a bpf_prog_has_trampoline() guard, causing
> unnecessary rejection of kprobe programs that share a prog_array with
> different call_get_func_ip values.
